From: Specializing network analysis to detect anomalous insider actions
Variable | Description |
---|---|
S = {s_{1}, s_{2}, . . . , s_{ m }} | The set of subjects in the CIS. |
U = {u_{1}, u_{2}, . . . , u_{ n }} | The set of users in the CIS. |
u_{ j } → s_{ i } | An access of user u_{ j } to subject s_{ i }. |
${U}_{{s}_{i}}$ | The set of users that access subject s_{ i }. |
$Ne{t}_{{s}_{i}}$ | A complete graph of ${U}_{{s}_{i}}$. |
SU | A binary matrix of subjects and users, the size of which is m × n. If u_{ i } accesses s_{ j }, SU(j, i) = 1, else SU(j, i) = 0. |
U _{ i } | A column vector of access history of u_{ i } on all subjects. U_{ i } = SU[:, i]. |
SU_IDF | A matrix with the same size as SU. Each cell value of SU_IDF corresponds to its inverse document frequency (IDF) transformation. |
B = [1, 1, . . . , 1] | A vector of 1's of length m. |
IDF_U _{ i } | A column vector of access history of u_{ i } on all subjects. IDF_U_{ i } = SU_IDF[:, i]. |
PC' | A matrix created from SU or SU_IDF, the size of which is l × n, where l is the number of selected principal components. |
λ _{ k } | The k^{th} eigenvalue |
λ _{ total } | The sum of the l eigenvalues. |
λPC' | A matrix created from PC', where λPC'[k, :] = (λ_{ k }/λ_{ total }) × PC'[k, :]. |
C _{ i } | A column vector of u_{ i } on the selected l principal components. C_{ i } = λPC'[:, i]. |